Skip to content

Commit 2743655

Browse files
dageckodagecko
authored
Pin actions and extract expressions to env vars (#7719)
1 parent 8d9a44a commit 2743655

File tree

3 files changed

+31
-24
lines changed

3 files changed

+31
-24
lines changed

‎.github/workflows/build.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434
- name: Checkout repo
3535
uses: actions/checkout@v6
3636
- name: Check changed files
37-
uses: dorny/paths-filter@v3
37+
uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
3838
id: filter
3939
with:
4040
filters: |
@@ -98,7 +98,7 @@ jobs:
9898
if: needs.changes.outputs.helm == 'true'
9999
steps:
100100
- uses: actions/checkout@v6
101-
- uses: azure/setup-helm@v4
101+
- uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
102102
with:
103103
token: ${{ secrets.GITHUB_TOKEN }}
104104
- run: helm plugin install https://github.com/instrumenta/helm-kubeval
@@ -151,7 +151,7 @@ jobs:
151151
test/package-lock.json
152152
- run: SKIP_SUBMODULE_DEPS=1 npm ci
153153
- run: npm run test:unit
154-
- uses: codecov/codecov-action@v5
154+
- uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5
155155
if: success()
156156
with:
157157
token: ${{ secrets.CODECOV_TOKEN }}
@@ -167,7 +167,7 @@ jobs:
167167
with:
168168
submodules: true
169169
- run: sudo apt update && sudo apt install -y libkrb5-dev
170-
- uses: awalsh128/cache-apt-pkgs-action@latest
170+
- uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # latest
171171
with:
172172
packages: quilt
173173
version: 1.0

‎.github/workflows/publish.yaml‎

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ jobs:
3333
node-version-file: .node-version
3434

3535
- name: Download npm package from release artifacts
36-
uses: robinraju/release-downloader@v1.12
36+
uses: robinraju/release-downloader@daf26c55d821e836577a15f77d86ddc078948b05 # v1.12
3737
with:
3838
repository: "coder/code-server"
3939
tag: ${{ github.event.inputs.version || github.ref_name }}
@@ -43,9 +43,10 @@ jobs:
4343
# Strip out the v (v4.9.1 -> 4.9.1).
4444
- name: Get and set VERSION
4545
run: |
46-
TAG="${{ github.event.inputs.version || github.ref_name }}"
4746
echo "VERSION=${TAG#v}" >> $GITHUB_ENV
4847
48+
env:
49+
TAG: ${{ github.event.inputs.version || github.ref_name }}
4950
- run: npm run publish:npm
5051
env:
5152
VERSION: ${{ env.VERSION }}
@@ -88,11 +89,12 @@ jobs:
8889
# Strip out the v (v4.9.1 -> 4.9.1).
8990
- name: Get and set VERSION
9091
run: |
91-
TAG="${{ github.event.inputs.version || github.ref_name }}"
9292
echo "VERSION=${TAG#v}" >> $GITHUB_ENV
9393
94+
env:
95+
TAG: ${{ github.event.inputs.version || github.ref_name }}
9496
- name: Validate package
95-
uses: heyhusen/archlinux-package-action@v3.0.0
97+
uses: heyhusen/archlinux-package-action@c9f94059ccbebe8710d31d582f33ef4e84fe575c # v3.0.0
9698
env:
9799
VERSION: ${{ env.VERSION }}
98100
with:
@@ -119,19 +121,19 @@ jobs:
119121
uses: actions/checkout@v6
120122

121123
- name: Set up QEMU
122-
uses: docker/setup-qemu-action@v3
124+
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
123125

124126
- name: Set up Docker Buildx
125-
uses: docker/setup-buildx-action@v3
127+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
126128

127129
- name: Login to Docker Hub
128-
uses: docker/login-action@v3
130+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
129131
with:
130132
username: ${{ secrets.DOCKER_USERNAME }}
131133
password: ${{ secrets.DOCKER_PASSWORD }}
132134

133135
- name: Login to GHCR
134-
uses: docker/login-action@v3
136+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
135137
with:
136138
registry: ghcr.io
137139
username: ${{ github.actor }}
@@ -140,19 +142,20 @@ jobs:
140142
# Strip out the v (v4.9.1 -> 4.9.1).
141143
- name: Get and set VERSION
142144
run: |
143-
TAG="${{ github.event.inputs.version || github.ref_name }}"
144145
echo "VERSION=${TAG#v}" >> $GITHUB_ENV
145146
147+
env:
148+
TAG: ${{ github.event.inputs.version || github.ref_name }}
146149
- name: Download deb artifacts
147-
uses: robinraju/release-downloader@v1.12
150+
uses: robinraju/release-downloader@daf26c55d821e836577a15f77d86ddc078948b05 # v1.12
148151
with:
149152
repository: "coder/code-server"
150153
tag: v${{ env.VERSION }}
151154
fileName: "*.deb"
152155
out-file-path: "release-packages"
153156

154157
- name: Download rpm artifacts
155-
uses: robinraju/release-downloader@v1.12
158+
uses: robinraju/release-downloader@daf26c55d821e836577a15f77d86ddc078948b05 # v1.12
156159
with:
157160
repository: "coder/code-server"
158161
tag: v${{ env.VERSION }}

‎.github/workflows/release.yaml‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -111,14 +111,15 @@ jobs:
111111
# Strip out the v (v4.9.1 -> 4.9.1).
112112
- name: Get and set VERSION
113113
run: |
114-
TAG="${{ inputs.version || github.ref_name }}"
115114
echo "VERSION=${TAG#v}" >> $GITHUB_ENV
116115
116+
env:
117+
TAG: ${{ inputs.version || github.ref_name }}
117118
- env:
118119
VERSION: ${{ env.VERSION }}
119120
run: npm run package $PKG_ARCH
120121

121-
- uses: softprops/action-gh-release@v1
122+
- uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
122123
with:
123124
draft: true
124125
discussion_category_name: "📣 Announcements"
@@ -171,15 +172,16 @@ jobs:
171172
# Strip out the v (v4.9.1 -> 4.9.1).
172173
- name: Get and set VERSION
173174
run: |
174-
TAG="${{ inputs.version || github.ref_name }}"
175175
echo "VERSION=${TAG#v}" >> $GITHUB_ENV
176176
177+
env:
178+
TAG: ${{ inputs.version || github.ref_name }}
177179
- name: Build packages with nfpm
178180
env:
179181
VERSION: ${{ env.VERSION }}
180182
run: npm run package
181183

182-
- uses: softprops/action-gh-release@v1
184+
- uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
183185
with:
184186
draft: true
185187
discussion_category_name: "📣 Announcements"
@@ -232,15 +234,16 @@ jobs:
232234
# Strip out the v (v4.9.1 -> 4.9.1).
233235
- name: Get and set VERSION
234236
run: |
235-
TAG="${{ inputs.version || github.ref_name }}"
236237
echo "VERSION=${TAG#v}" >> $GITHUB_ENV
237238
239+
env:
240+
TAG: ${{ inputs.version || github.ref_name }}
238241
- name: Build packages with nfpm
239242
env:
240243
VERSION: ${{ env.VERSION }}
241244
run: npm run package
242245

243-
- uses: softprops/action-gh-release@v1
246+
- uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
244247
with:
245248
draft: true
246249
discussion_category_name: "📣 Announcements"
@@ -257,7 +260,7 @@ jobs:
257260
with:
258261
name: npm-release-package
259262

260-
- uses: softprops/action-gh-release@v1
263+
- uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
261264
with:
262265
draft: true
263266
discussion_category_name: "📣 Announcements"
@@ -269,7 +272,7 @@ jobs:
269272
timeout-minutes: 15
270273
steps:
271274
- name: Download artifacts
272-
uses: dawidd6/action-download-artifact@v16
275+
uses: dawidd6/action-download-artifact@2536c51d3d126276eb39f74d6bc9c72ac6ef30d3 # v16
273276
id: download
274277
with:
275278
branch: ${{ github.ref }}
@@ -284,9 +287,10 @@ jobs:
284287
# Strip out the v (v4.9.1 -> 4.9.1).
285288
- name: Get and set VERSION
286289
run: |
287-
TAG="${{ inputs.version || github.ref_name }}"
288290
echo "VERSION=${TAG#v}" >> $GITHUB_ENV
289291
292+
env:
293+
TAG: ${{ inputs.version || github.ref_name }}
290294
- name: Modify version
291295
env:
292296
VERSION: ${{ env.VERSION }}

0 commit comments

Comments
 (0)